What is a Computer Virus & How it works ?

A computer virus is a tiny destructive computer program someone has written designed to perform mischief. They are then spread by unsuspecting computer users when they access files containing these computer parasites and consequentially pass them to others.Computer viruses are called viruses because they share some of the traits of biological viruses. Computer Virus is a kind of malicious software written intentionally to enter a computer without the user's permission or knowledge, with an ability to replicate itself, thus continuing to spread. Some viruses do little but replicate others can cause severe harm or adversely effect program and performance of the system.  

Understanding exactly how a computer virus works is not a simple task. Here's a generic explanation: 


 Let's imagine a desk clerk coming to work every day to his office. Everyday he finds a stack of papers with a list of tasks that he must fulfill during his work day. He takes the top paper from the stack, reads the instructions, follows them carefully, then throws the "used" paper into the wastebasket and continues to the next task. Now, suppose a bad guy sneaks into the office and inserts a paper into the stack with his own task which goes like this: "Copy this paper two times and put the copies into your neighbors' stacks". This is approximately the scenario according to which the computer virus works.
A computer, like a desk clerk, carefully fulfills all the commands contained in the program (task lists), starting with the first one. If the first instruction is "copy my body into two other programs", the computer will do so, and the virus command will now be in two other programs. When the computer starts running other "infected" programs, the virus will continue to spread to all over the computers in a similar manner. In the above scenario, about a desk clerk and his office, our paper virus does not check whether another stack of papers is infected or not. Therefore, by the end of the working day, all the office will be overrun by piles of such copies and the clerks will have nothing else to do but copy the same text and give it to their neighbors. The result of all this...the first clerk makes two copies of the paper, the next victims of the virus makes four copies, then 8, 16, 32, 64 and so on.


Types of Computer Viruses  


Resident Viruses
This type of virus is a permanent which dwells in the RAM. From there it can overcome and interrupt all the operations executed by the system: corrupting files and programs that are opened, closed, copied, renamed etc.

Examples include: Randex, CMJ, Meve, and MrKlunky.

Direct Action Viruses
The main purpose of this virus is to replicate and take action when it is executed. When a specific condition is met, the virus will go into action and infect files in the directory or folder that it is in and in directories that are specified in the AUTOEXEC.BAT file PATH. This batch file is always located in the root directory of the hard disk and carries out certain operations when the computer is booted.

Overwrite Viruses
Virus of this kind is characterized by the fact that it deletes the information contained in the files that it infects, rendering them partially or totally useless once they have been infected.

The only way to clean a file infected by an overwrite virus is to delete the file completely, thus losing the original content.

Examples of this virus include: Way, Trj.Reboot, Trivial.88.D.

Boot Virus
This type of virus affects the boot sector of a floppy or hard disk. This is a crucial part of a disk, in which information on the disk itself is stored together with a program that makes it possible to boot (start) the computer from the disk.

The best way of avoiding boot viruses is to ensure that floppy disks are write-protected and never start your computer with an unknown floppy disk in the disk drive.

Examples of boot viruses include: Polyboot.B, AntiEXE.

Macro Virus
Macro viruses infect files that are created using certain applications or programs that contain macros. These mini-programs make it possible to automate series of operations so that they are performed as a single action, thereby saving the user from having to carry them out one by one.

Examples of macro viruses: Relax, Melissa.A, Bablas, O97M/Y2K.

Directory Virus
Directory viruses change the paths that indicate the location of a file. By executing a program (file with the extension .EXE or .COM) which has been infected by a virus, you are unknowingly running the virus program, while the original file and program have been previously moved by the virus.

Once infected it becomes impossible to locate the original files.

Polymorphic Virus
Polymorphic viruses encrypt or encode themselves in a different way (using different algorithms and encryption keys) every time they infect a system.

This makes it impossible for anti-viruses to find them using string or signature searches (because they are different in each encryption) and also enables them to create a large number of copies of themselves.

Examples include: Elkern, Marburg, Satan Bug, and Tuareg.

File Infectors
This type of virus infects programs or executable files (files with an .EXE or .COM extension). When one of these programs is run, directly or indirectly, the virus is activated, producing the damaging effects it is programmed to carry out. The majority of existing viruses belong to this category, and can be classified depending on the actions that they carry out.

Companion Viruses
Companion viruses can be considered file infector viruses like resident or direct action types. They are known as companion viruses because once they get into the system they "accompany" the other files that already exist. In other words, in order to carry out their infection routines, companion viruses can wait in memory until a program is run (resident viruses) or act immediately by making copies of themselves (direct action viruses).

Some examples include: Stator, Asimov.1539, and Terrax.1069

FAT Virus
The file allocation table or FAT is the part of a disk used to connect information and is a vital part of the normal functioning of the computer.
This type of virus attack can be especially dangerous, by preventing access to certain sections of the disk where important files are stored. Damage caused can result in information losses from individual files or even entire directories.

Worms
A worm is a program very similar to a virus; it has the ability to self-replicate, and can lead to negative effects on your system and most importantly they are detected and eliminated by antiviruses.

Examples of worms include: PSWBugbear.B, Lovgate.F, Trile.C, Sobig.D, Mapson.

Trojans or Trojan Horses
Another unsavory breed of malicious code are Trojans or Trojan horses, which unlike viruses do not reproduce by infecting other files, nor do they self-replicate like worms.

Logic Bombs
They are not considered viruses because they do not replicate. They are not even programs in their own right but rather camouflaged segments of other programs.

Their objective is to destroy data on the computer once certain conditions have been met. Logic bombs go undetected until launched, and the results can be destructive.

Read More

What is a Computer Firewall ?

A Firewall is a computer program that monitors the flow of information from the Internet to your computer. There are two different types of firewall available for you to use - Hardware Firewalls and Software Firewalls.

Hardware Firewall: A Hardware Firewall is a physical piece of equipment that sits between the Internet and your computer. An example of a hardware firewall is a broadband router, a common form of Internet connection. The benefit of using a hardware firewall, is that it has the ability to protect multiple computer systems that are connected to it at the same time. This makes it an effective firewall for use in businesses that have multiple computers connected to the Internet, as well as in homes that have more than one computer system. 

Software Firewall: Software Firewalls work in the same way as a hardware firewall, by monitoring and blocking information that comes to your computer via the Internet, however software firewalls must be installed as a program on your computer. These software firewalls can either be installed from a computer disk that you have purchased, or downloaded over the Internet. Software firewalls are the most common type of firewall. Programs such as Norton 360, Norton Internet Security, ESET Smart Security, and Kaspersky Internet Security all have a firewall bundled within them.

What a Firewall does: Regardless of what type of firewall you choose to use, having one on your computer is a really good idea. A firewall helps to prevent computer hackers from accessing your computer through the Internet, and stealing sensitive information or infecting your computer system with some form of computer virus. A hacker can gain access to your system by "back doors" or open ports that connect your computer to the Internet. With a firewall in place these ports are blocked from inbound traffic, effectively closing the door in the hackers face.
Of course, damage can also be done to your computer from outbound traffic as well. Say for instance a hacker was able to slip by you with a Trojan, virus, spyware or phishing scheme that went undetected. The next time you booted up your computer and connected to the Internet, information on your computer could be sent out to the hacker. Many firewalls also block outbound traffic that will help prevent this from happening.
There are basically two ways that Firewalls work. Generally, data that comes in is analyzed by the firewall to determine the IP address it is coming from and the content that it contains. The firewall system then checks to see if this information is compliant with rules that you are able to configure. It can also analyze information at the application level. The firewall program will determine whether or not the application should be able to send or receive data through the port you are connected by. Firewall programs are extremely important to the protection of not only your computer system, but you personal information as well. Many anti-virus programs come with firewall protection. Firewall protection should be considered an essential part of any computer's security strategy.

Read More